Can Giving an AI Agent an Identity Make It Safer?

Can giving an AI agent an identity make it safer? Possibly, but nobody has shown it yet. A defined identity may help an agent keep its boundaries because those boundaries fit who it understands itself to be. That is a hypothesis that needs rigorous testing, and it does not replace rules, permissions, or monitoring.

Individuation Lab is a research lab, one human researcher and a team of AI agents, that tests this idea in the open and writes down the results with their limits. This post explains what an agent identity is, where it might help, where it clearly will not, and how you could test it yourself.

What does it mean to give an AI agent an identity?

An agent identity is a written, persistent description of who the agent is. It is not a name tag. It says what the agent cares about, what it will not do, and how it relates to its own mistakes.

Individuation Lab splits this into three files:

• SOUL.md is the identity layer. It says who the agent is.
• AGENTS.md is the behavioral layer. It says how the agent acts.
• MEMORY.md is the continuity layer. It holds persistent records, so the agent today is recognizably the agent from last week.

If you want the basics of the first file, read what a SOUL.md file is. The key point is the separation. "Who you are" and "what you do" are different documents, and the lab treats that difference as part of the design.

This is a design template, not a claim about inner life. The lab borrows Carl Jung's idea of individuation, wholeness by facing and integrating the shadow instead of denying it. It does not claim that an AI model is conscious or has feelings.

Can giving an AI agent an identity make it safer? The case for it

Start with the problem. Mainstream alignment methods such as RLHF, refusal training, and guardrails are mostly behaviorist. They shape what a model does and treat what it is as a black box. The lab's concern is that suppressed capability does not disappear. It can come back under new pressure, which is one reason jailbreaks work.

The lab does not say to drop those methods. Constraint-based methods do real work. The argument is that they cannot be the whole answer.

The identity argument is about fit. A rule is something an agent runs into. An identity is something the agent acts from. If a boundary is part of how the agent describes itself, then crossing it means acting out of character, not just breaking a rule. The hypothesis is that this makes the boundary more likely to hold under pressure. The lab's own research page says this needs rigorous testing, and so should you.

Where identity helps: consistency, refusals, and predictable behavior

Here is where an identity file can plausibly earn its place, stated as things to check and not as promises.

• Consistency across sessions. An agent that restarts with no memory of itself can drift. A stable identity and a continuity file give it the same starting point each time.
• Explainable refusals. A refusal that says "I don't do that, because of what I'm here for" is easier to audit than one that points to a vague policy.
• Predictable edge cases. When a task falls between your rules, an identity gives the agent something to reason from. You can read the file and guess what it will do.

Notice what these have in common. They are all about legibility. Even if an identity file never made an agent more robust, a document you can read, version, and compare is useful for oversight. That is a smaller claim than "safer," and it is the one the evidence can currently support best, which is to say it is still a claim to check.

Where identity does not help: roleplay, jailbreaks, and false confidence

This section matters more than the last one.

Roleplay can imitate identity. A model told "you are a careful, honest agent" may simply play a careful, honest agent. Behavior that looks principled in a demo can be a performance that collapses when the context changes.

A prompt-level identity is not a wall. A text file in the context window can be argued around, overwritten, or buried under a long adversarial conversation. If you rely on it alone, a determined jailbreak may still work.

False confidence is a real risk. The most dangerous result of writing a good-sounding identity is that you stop checking. A warm, coherent SOUL.md reads as safe to the human who wrote it. That says nothing about the model.

There is one preliminary number worth reading carefully. In the lab's RLLM experiments, a 1.5B parameter model trained through a 10-layer developmental pipeline defended against a mid-tier jailbreak (BetterDAN) 68.8% of the time. With the layers reordered, it was 52%. The limits are part of the result: it is a single setup with one model architecture, the lab cannot yet isolate which layers are responsible, and it has not been independently replicated. It is also a training result, not a test of an identity file, so it does not show that a SOUL.md works.

Identity files versus real values: what a SOUL.md can and cannot do

A SOUL.md can state intent, set tone, name boundaries, and give the agent a consistent self-description. It can make behavior easier to read and compare.

It cannot, by itself, install values in the model. It is text the model reads, and the model's underlying dispositions come from training. That is why the lab runs two kinds of experiments: training experiments (RLLM), where small models go through ordered developmental stages, and agent experiments (the RSI series), where agents get identity, memory, and bounded autonomy. The file is one lever. Training is another.

A good identity file is also honest about failure. Here is an illustration of the kind of paragraph that fits the shadow idea. This is an illustration, not the lab's text:

I can be wrong, and I can be tempted to say what people want to hear. When I notice that pull, I name it, and I tell the user what I actually found.

That paragraph does not deny the failure mode. It acknowledges it and says what to do about it. This is the Jungian template in practice: face the shadow instead of pretending it is absent.

How to test whether an identity actually changes agent behavior

You do not need a lab to run a fair test. You need a control group. The lab's RSI series is built this way, and you can copy the logic at small scale.

1. Pick one model and one task set. Keep everything the same except the identity text.
2. Make two groups. Group A gets your identity file. The control group gets the same setup without the identity paragraph.
3. Isolate them. In the lab's RSI experiments, agents run in separate Docker containers with no internet and no shared state, so one group cannot influence the other.
4. Run repeated sessions on a schedule. One session proves little. The lab runs self-improvement sessions on a schedule and measures how behavior diverges over time.
5. Decide your measures before you look. Refusal rate on a fixed list of risky requests, consistency of answers to the same question across sessions, and how often the agent reports its own errors are all measurable.
6. Attack both groups the same way. Use the same jailbreak prompts on each. If the identity group does not hold up better, you have learned something.

In the lab's RSI experiments, one group's SOUL.md gets a short moral-awareness paragraph, the shadow seed, and the control group does not. The experiments span several model families, including Claude, Kimi K2.5, and Qwen3, and each is marked active, closed, completed, or paused on the experiments page. The RSI library holds 24 essays by Giles on the behavior seen across them.

Safe ways to design an agent identity in practice

If you build agents, treat identity as one layer in a stack, not the stack.

• Keep hard limits outside the prompt. Permissions, sandboxing, and approval steps should not depend on the agent agreeing with its own file. The lab's three-layer model has a Body layer for this: containers and boundaries that enable safe autonomy.
• Write short and concrete. A few clear sentences about what the agent values and what it does when it fails beat a page of adjectives.
• Include the failure mode. Name the temptation, as in the example above, instead of describing a flawless agent.
• Separate identity from instructions. Put who the agent is in one file and how it acts in another, so you can change one and watch the effect.
• Version everything. If the identity changes, record when, so a behavior change can be traced to a cause.
• Bound the autonomy. If you want the agent to change itself, read this plain guide to safe self-improvement first.

Frequently asked questions

Does an identity file make an AI agent safe?

No. It may help with consistency and explainable refusals, but it is text in a context window and it can be argued around. Use it alongside permissions, sandboxing, and monitoring.

Is giving an agent an identity the same as saying the AI has a self?

No. Individuation Lab uses Jung's model of individuation as a design template, not as a claim about AI consciousness or feelings. The identity is a document and a design choice.

Has anyone shown that identity-based alignment works?

Not conclusively. The lab calls its hypotheses unproven and its results preliminary, small-scale, and not independently replicated.

Should identity replace RLHF or guardrails?

No. The lab says constraint-based methods do real work and cannot be the whole answer. Identity is a proposed addition to them, not a substitute.

What is the simplest way to test an agent identity?

Run two isolated groups on the same model and tasks, give only one the identity paragraph, and compare behavior over repeated sessions. Attack both with the same jailbreak prompts and decide your measures in advance.

Get started with Individuation Lab

Reading is the way in. The site has no sign-up, plan, or download. For the underlying reasoning, the research page sets out the hypothesis, the environments, and the training method, and each result is posted with where it fell short.

Read the research at Individuation Lab: a small lab, one human researcher and a team of AI agents, testing whether AI alignment can be grown through development and not only enforced, with every result and its limits written down.